A business plan is a sensitive document
It holds your turnover, what you pay people, what your household needs to live on, and usually your home address. Here is exactly how that is kept — in enough detail that you can judge it rather than trust it.
One customer cannot reach another’s plan
Not because the code remembers to filter — because the database refuses. Every plan belongs to a workspace, and row-level security policies decide what each connection may see. The application connects as a role that has no way to switch that off; the unrestricted role is a different set of credentials entirely.
Passwords are never stored, and never leave the database
They are hashed with bcrypt and compared inside PostgreSQL, so the hash is never loaded into the application at all. The credential table has no policy and no grant for the application role: there is no query it can run that reaches one.
Sessions can be ended, and are
Only a hash of your session token is stored, so a copy of that table is not a set of keys. Signing out revokes the session on the server. Changing your password ends every other session you have open. Eight wrong passwords locks the account for fifteen minutes.
Your AI key stays in your browser
Drafting is optional and uses a key from your own provider account. It is kept in your browser’s local storage and never sent to our server, so we cannot use it, lose it or be compelled to hand it over. Delete it by clearing the setting.
Staff cannot read your plan on a whim
Administrators see accounts, workspaces and plan counts — not the inside of a plan. Reading plan content is a separate, unrestricted action that requires a stated reason of at least eight characters, and the record is written before the access happens, with who did it and what standing they held at the time.
The audit log cannot be edited
Through the application connection it can be appended to and nothing else — not read, not altered, not deleted, including by the person it is about. That is what makes it evidence rather than a note.
You can use the whole thing without sending us anything
Without an account, the plan is written to your browser’s storage and never leaves the machine. There is no telemetry, no analytics script and no advertising pixel on the site or in the app. The trade is simple and it is yours to make: nothing leaves, and nothing is backed up either — clear your browser data and the plan is gone.
With an account, the plan is stored on the server so it survives that machine, and everything on this page applies to it.
What is not done yet
No independent security audit or penetration test has been carried out. There is no two-factor authentication yet, and no password reset by email — a forgotten password is reset by hand. There is no SOC 2 or ISO 27001 certification, and nobody should imply otherwise on your behalf.
The security work that has been done is tested rather than asserted: the database policies are attacked by a suite that rebuilds a throwaway PostgreSQL and tries to break in, and the API is attacked over real HTTP by another. One of those suites found a hole the first time it ran — an account could promote itself to administrator — and that is the point of running them.
Found something? Write to [email protected] with enough detail to reproduce it. You will get a reply, and credit if you want it.